Enable shell tasks arguments validation

Contributed by Sebastian ClaessonAll contributors →

Part of Maester · Azure DevOps · Pipelines · All checks

Run this check

Invoke-Maester -TestId AZDO.1025

Overview

Enable Shell Task Validation to prevent code injection.

Rationale: Code injection through arguments parameters should be prevented.

Remediation action

Enable the policy to stop these requests and notifications.

1. Sign in to your organization.
2. Choose Organization settings.
3. Select Settings under Pipelines.
4. Go to the section “Task restrictions” and turn on “Enable shell tasks arguments validation”

Results: This validation applies to the arguments parameter in the following specific tasks:

• PowerShell
• BatchScript
• Bash
• Ssh
• AzureFileCopy
• WindowsMachineFileCopy

Related links

• Learn - Shell Tasks Validation

Details

Every attribute of this check

Field	Value
Test ID	AZDO.1025
Severity	High
Suite	Maester
Product	Azure DevOps
Feature	Pipelines
Area	Engineering systems
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1059 Command and Scripting Interpreter, T1677 Poisoned Pipeline Execution
Supports controls	nist-800-53-r5:SI-10
PowerShell test	Test-AzdoOrganizationTaskRestrictionsShellTaskArgumentValidation
Services	AzureDevOps
Learn more	https://learn.microsoft.com/azure/devops/pipelines/security/inputs?view=azure-devops#shellTasksValidation

Source

• Test: tests/maester/azure-devops/Test.AZDO.1025.ps1
• Documentation: tests/maester/azure-devops/Test.AZDO.1025.md